
Subject: FW: Urgent FOIA Request - Deadline - Friday, August 3, 2007 

Importance: High 


SENSITIVE BUT UNCLASSIFIED 

NON-RECORD b6 

b7C 



♦ 


I want to clear up any misconceptions you have abou j l and my role here. We are here to provide you with legal 

advice concerning Science and Technology matters. Also ] ~f ls my backup for CEAU and my other units, just as I am 

hi s backup fo r his units in his absence. It is improper for you, to send general "taskers" to either one of us, and particularly 
td [if I am here. 



b2 

b6 

b7C 


— Original Mess age — 
From; | 

Sent; 1 hnoav . Jul 

To: I 

Subject: FW: l 

Importance; High 


|(OTD) (CON) 
Friday. July UT 2QV7 4:45 PM 
ItOGC) (FBI); 

FW: Urgent FOIA Request - i 
High 


K OGC) (FBI) 
line - Friday, August 3, 2007 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b6 

b7C 


Good Afternoon, 


he 

b7C 


Per a request from CEAU UC| he wanted you both to review the Urgent FOIA request below, If you 

have any questions, please contact me at the below numbers. 


v/r, 

Leslie 



i 

ALL INFORMATION ' CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 08-28-2008 BY 6Q322UC/LP/STP/gj g 











* 


< 


b6 

b7C 


Cc: 

Subject: 

importance: 


I f OTP) (CON) 

Urgent FOIA Request - Deadline - Friday, August 3, 2007 
High 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Good Afternoon, 


Per UC| 

All information is to 


please provide hard copies of ALL documentation, to include e-mails, concerning CIPAV Technology, 
be turned in by COB Friday. August 3rd. 2007 . Additionally, it is requested tha t you please put ail 


documents in chronological order. If I am not in the office that day, please take your documents to 


Thanks, 


Management Assistant 

Operational Technology Division (QTD) 

Cryptologic and Electronic Analysis Unit (CEAU) 

[(Chantilly) 

Quantico) 

Cell) 


b2 

b6 

b7C 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 


i 

i 

i 

i 


i 
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Subject: RE: Urgent FOIA Request - Deadline - Friday, August 3, 2007 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


There is nothing to review in your e-mail to the unit concerning the Urgent FOIA request. In fact, if there was a copy of the 
FOIA attached, there would be nothing for us to review. When a FOIA request goes out from HQ, the persons receiving 
the request must gather ail responsive documents, note any concerns they have about the release of those documents, 
and send it to the person that sent the request. The FBI has a FOIA unit that, in conjunction with the FOIA Litigation Unit 
of OGC, reviews what is submitted to them to determine what will must be released and what we will claim an exception 
for. 



— Origins 

From: 

Sent: 

To: 

Subject: 


|(0TD) (CON) 

Friday. July 27, 2007 4:45 PM 

— tO GC) (FBI) } 

FW: Urgent FOIA Request - Deadline - 


[ OGC) (FBI) 
: riday, August 3 f 2007 


Importance: High 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


h6 

b7C 


Good Afternoon, 


Per a request from CEAU UQ 

you have any questions, please contact me a 


[he wanted you both to review the Urgent FOIA request below. If 

ieTelow numbers. 



Subject: Urgent FOIA Request - Deadline * Friday, August 3, 2007 

1 

ALL INFORMATION CONTAINED 

HEREIN 15 UNCLASSIFIED 

DATE 08-28-2008 BY 6Q322UC/LP/STP/gjg 








Importance: High 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Good Afternoon, 


Per UC j [ please provide hard copies of ALL documentation, to include e-mails, concerning CIPAV 

Technology. All information is to be turned in by COB Friday. August 3rd. 2007 . Additionally, it is requested that you 
please out all docum ents in chronological order. If I am not in the office that day, please take your documents to 


Thanks, 

b2 

b6 

. b7C 


Management Assistant 
Operational Technology Division (OTD) 

Electronic Analysis Unit (CEAU) 
Chantilly) 

Quantico) 

Cell) 


wrvotolQqic and 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


■4 
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to 6 
tolC 




I (OTP) (CON) 

From: I I fOTD) (CON) 

Sent: Friday. July 27. 2 007 4:45 PM 

To: I” ~_n(° G C) (FBI)| I (OGC) (FBI) 

Subject: FW: Urgent FOIA Request - Deadline - Friday, August 3, 2007 

Importance: High 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Good Afternoon, 


be 

b7C 


Per a request from CEAU Uq 
have any questions, please contact me at the below 


he wanted you both to review the Urgent FOIA request below. If you 
numbers. 


UlL 


Original Mess age — 

From: 

Sent: 

To: 


ijfl 





V ■ I 

fOTDl rFB Di 


1( OTD) (CON) 
j.S. 2QQ 7 2:06 PM 
tOT D) (FBI) 


(CO NT 


lOTD) (FBI)j 


: BI) 1 

uc<m— 

IrQTpifFBm 


OTD) (CON)| 
LTD) (CON)) 




OTD) (CON)J 

ummDl 


Iotp) 


CQXQliCQN3l 

|(OTD) (C ONf 


korsnaa 


2 OTD) (FBI) \ 
)S) (CON) ; L 


SoT D) (FBI)d 


iQID) (FBI); I 


IOTP) (CON VI 


joTD) (FBl[ 


f(OTD) (CON[ 



















OTD) (CON) 




OTD) (FBI); 


1 


Cc: 

Subject: 

Importance: 


[ 




](OS) (CON)[ 


I (OTD) (FBI)f 


J(OTD) (CON)i 


IO TP) (FBI);[ 


SpTD) 


](OS) 


jOTD) (CON) 


Urgent FOIA Request - Deadline - Friday, August 3, 2007 
High 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Good Afternoon, 


Per Ucf 


please provide hard copies of ALL documentation, to include e-mails, concerning CIPAV Technology, 
be turned in by COB Friday, August 3rd. 2007 . Additionally, it is requested tha t vou please put all 


All information is to 

documents in chronological order. If I am not in the office that day, please take your documents tcj 


Thanks, 


=! 1 b2 

| b6 

Management Assistant b7 

Operational Technology Division (OTD) 

Cryptologic and Electronic Analysis Unit (CEAU) 

(Chantilly) 

(Quantico) 

(Cell) 


All IUF0RMATI GIT CONTAINED 

HEEEIN IS UNCLASSIFIED 

DATE 08-28-2008 BY 60322UC/LP/STP/gjg 


1 








(OTD) (CON) 


be 

b7C 


From: I I (OGC) (FBI) 

Sent: Monday. July 23. 200 7 12:22 PM 

To: I I (OGC) (FBI) 

Subject: RE: CIPAV/Magic Lantern news blurb - FYI 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD" X \ 


Just law enforcement sensitive. 


Assistant General Counsel 
Scien ce and Technology Law Unit 
Phom 

Cell phone: 

Sec ure phone: [ 

Fax:! 



b2 

b6 

b7C 


Original Mresanarn. . 

From: | [OGC) (FBI) 

Sent: Monday, July 23, 200 7 12; 22 PM 

To: I r OGC) (FBI) 

Subject: RE: CIPAV/Magic Lantern news blurb - FYI 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD ^ ^ 


AIL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 

DATE 06-22-2010 BY 67203 VCLP/STP b6 

b7C 


I'm assuming it was not a classified technique? 


Orig inal Message 

From: I ........ If OGCI (FBI) 

Sent: JjfflMlgiJ.till23.20O7 12:13 PM 

To: I l OGC) (FBI) 

Subject: RE: CIPAV/Magic Lantern news blurb - FYI 


SENSITIVE BUT UNC 


NON-RECORD 



Saw it. Thanks. People are not happy around here about it. I haven't been able to learn if the agent made the 
mistake of not filing under seal or whether the court removed the seal after the kid plead guilty and was sentenced. 


Assistant General Counsel 
Scienc e and Technology Law Unit 
Phone: l ~ I 

Ceil phoneL-.^^^ 


Fa)[ 


J 


b2 

b6 

b7C 


;ja 


— Original Mes sage 

From: 

Sent: 

To: 

Cc 


Monda y, July73 
^OGC) (£BU 


“koGC) (FBI) 
7T6 o7 12:11 PM 


](OGC) (FBI) 




Subject! I FW: QPAV/Magii BIU 

SENSITIVE BUT UN^tAS^IFIED 


|(OGC) (FBI) 
rb - FYI 


1 


1 




NON-RECORD 


JUST h Yl. 


— -Original Messa 

From: 

Se 
TO 

Cc: 


1 


(OGC) (FBI) 


Itfi ..Mnmfcy, lulv 23. 2007 11:38 AM 

: L kqjSC) (FBI); (OGC) (FBI); 

1 T |(OGC) (H i) 


(OGC) (FBI); 



OGC) (FBI) 


Subject: 


FW: QPAV/Magic Lantern news blurb - FYI 



h6 

blC 


I assume you folks know of this— but just in case. 


](OGC) (FBI) 


— Original Mess age — 

From: \ 

Sent Wednesday, July is, 20 07 i2:is pm r 

To: l TJfOGC) (FBI) J K OGQ ( fBl)J 

](OGC) (FBI); 


Subject: 


I p GQ (FBI) l 1,1 

ukav/ M agic Lan tern news Dlurb - FfT 




JOGC) (FBI)i 


SENSITIVE BUT 
NON-RECORD 



FBI’s Secret Spyware Tracks Down Teen Who 
Made Bomb Threats 

Wired.com 
2:00 AM 
By Kevin Poulsen 
July 18, 2007 

SEATTLE, WA — FBI agents trying to track the source of e- 
mailed bomb threats against a Washington high school last 
month sent the suspect a secret surveillance program designed 
to surreptitiously monitor him and report back to a 
government server, according to an FBI affidavit obtained by 
Wired News. 

The court filing offers the first public glimpse into the bureau's long-suspected 
spyware capability, in which the FBI adopts techniques more common to online 
criminals. The software was sent to the owner of an anonymous MySpace profile 
linked to bomb threats against Timberline High School near Seattle. The code 
led the FBI to 15-year-old Josh Glazebrook, a student at the school, who on 


2 




Monday pleaded guilty to making bomb threats, identity theft and felony 
harassment. In an affidavit seeking a search warrant to use the software, filed 
last month in U.S. District Court in the Western District of Washington, FBI 
agent Norman Sanders describes the software as a "computer and internet 
protocol address verifier," or CIPAV. 

FBI Spyware In A Nutshell 

The full capabilities of the FBF s "computer and internet protocol address 
verifier" are closely guarded secrets, but here's some of the data the malware 
collects from a computer immediately after infiltrating it, according to a bureau 
affidavit acquired by Wired News. 

• IP address 

• MAC address of ethernet cards 

• A list of open TCP and UDP ports 

• A list of running programs • The operating system type, version and serial 
number 

• The default internet browser and version 

• The registered user of the operating system, and registered company name, if 
any 

• The current logged-in user name 

• The last visited URL 

Once that data is gathered, the CIPAV begins secretly monitoring the 
computer's internet use, logging every IP address to which the machine connects. 
All that information is sent over the internet to an FBI computer in Virginia, 
likely located at the FBI 's technical laboratory in Quantico. Sanders wrote that 
the spyware program gathers a wide range of information, including the 
computer's IP address; MAC address; open ports; a list of running programs; 
the operating system type, version and serial number; preferred internet 
browser and version; the computer's registered owner and registered company 
name; the current logged-in user name and the last-visited URL. The CIPAV 
then settles into a silent "pen register" mode, in which it lurks on the target 
computer and monitors its internet use, logging the IP address of every computer 
to which the machine connects for up to 60 days. 

Under a ruling this month by the 9th U.S. Circuit Court of Appeals, such 
surveillance — which does not capture the content of the communications -- can 
be conducted without a wiretap warrant, because internet users have no 
"reasonable expectation of privacy" in the data when using the internet. 
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According to the affidavit, the CIPAV sends ail the data it collects to a central 
FBI server located somewhere in eastern Virginia. The server's precise location 
wasn't specified, but previous FBI internet surveillance technology — notably its 
Carnivore packet-sniffing hardware — was developed and run out of the 
bureau's technology laboratory at the FBI Academy in Quantico, Virginia. 

The FBI 's national office referred an inquiry about the CIPAV, to a 
spokeswoman for the FBI Laboratory in Quantico, who declined to comment on 
the technology. The FBI has been known to use PC-spying technology since at 
least 1999, when a court ruled the bureau could break into reputed mobster 
Nicodemo Scarfo's office to plant a covert keystroke logger on his computer. But 
it wasn't until 2001 that the FBI 's plans to use hacker-style coniputer-intrusion 
techniques emerged in a report by MSNBC.com. The report described an FBI 
program called "Magic Lantern" that uses deceptive e-mail attachments and 
operating-system vulnerabilities to infiltrate a target system. The FBI later 
confirmed the program, and called it a "workbench project" that had not been 
deployed. 

No cases have been publicly linked to such a capability until now, says David 
Sobel, a Washington, D.C., attorney with the Electronic Frontier Foundation. "It 
might just be that the defense lawyers are not sufficiently sophisticated to have 
their ears perk up when this methodology is revealed in a prosecution," says 
Sobel. "I think it's safe to say the use of such a technique raises novel and 
unresolved legal issues." The June affidavit doesn't reveal whether the CIPAV 
can be configured to monitor keystrokes, or to allow the FBI real-time access to 
the computer's hard drive, like typical Trojan malware used by computer 
criminals. It notes that the "commands, processes, capabilities and ... 
configuration" of the CIPAV is "classified as a law enforcement sensitive 
investigative technique, the disclosure of which would likely jeopardize other 
ongoing investigations and/or future use of the technique." 

i 

The document is also silent as to how the spyware infiltrates the target's 
computer. In the Washington case, the FBI delivered the program through 
MySpace's messaging system, which allows HTML and embedded images. The 
FBI might have simply tricked the suspect into downloading and opening an 
executable file, says Roger Thompson, CTO of security vendor Exploit 
Prevention Labs. But the bureau could also have exploited one of the legion of 
web browser vulnerabilities discovered by computer-security researchers and 
cybercrooks — or even used one of its own. "It's quite possible the FBI knows 
about vulnerabilities that have not been disclosed to the rest of the world," says 
Thompson. "If they had discovered one, they would not have disclosed it, and 
that would be a great way to get stuff on people's computer. Then I guess they 
can bug whoever they want." 

The FBI 's 2008 budget request hints at the bureau's efforts in the hacking arena, 


i 



including $220,000 sought to " purchase highly specialized equipment and 
technical tools used for covert (and) overt search and seizure forensic operations. 
... This funding will allow the technology challenges (sic) including bypass, 
defeat or compromise of computer systems." With the FBI in the business of 
hacking, security companies are in a tight place. Thompsons LinkScanner 
product, for example, scans web pages for security exploits, and warns the 
customer if one is found. How would his company respond if the FBI asked him 
to turn a blind eye to CIPAV? He says he's never fielded such a request. "That 
would put us in a very difficult position," Thompson says. "I don’t know what 
I’d say.” 

The Washington case unfolded May 30, when a handwritten bomb threat 
prompted the evacuation of Timberline High School in Lacey, Washington. No 
bomb was found. On June 4, a second bomb threat was e-mailed to the school 
from a Gmail account that had been newly created under the name of an 
innocent student. "I will be blowing up your school Monday, June 4, 2007," the 
message read. "There are 4 bombs planted throughout Timberline high school. 
One in the math hall, library hall, main office and one portable. The bombs will 
go off in 5 minute intervals at 9:15 AM." In addition, the message promised, 

"The e-mail server of your district will be offline starting at 8:45 am." 

The author made good on the latter threat, and a denial-of-service attack 
smacked the North Thurston Public Schools computer network, generating a 
relatively modest 1 million packets an hour. Responding to the bomb threat, 
school administrators ordered an evacuation of the high school, but, once again, 
no explosives were found. That began a bizarre cat-and-mouse game between 
law enforcement and school officials and the ersatz cyberterrorist, who e-mailed 
a new hoax bomb threat every day for several days, each triggering a new 
evacuation. Each threat used the same pseudonym, but was sent from a different, 
newly created Gmail account to complicate tracing efforts. 


On June 7, the hoaxer started issuing threats through other online mediums. In 
his most brazen move, he set up a MySpace profile called Timberlinebombinfo 
and sent friend requests to 33 classmates. The whole time he was daring law 
enforcement officials to trace him. "The e-mail was sent over a newly made 
Gmail account, from overseas in a foreign country," he wrote in one message. 
"Seeing as you're too stupid to trace the e-mail back lets (sic) get serious," he 
taunted in another. "Maybe you should hire Bill Gates to tell you that it is 
coming from Italy. HAHAHA. Oh wait. I already told you that it’s coming from 
Italy." As promised, attempts to trace the hoaxer dead-ended at a hacked server 
in Grumello del Monte, Italy. 


The FBI ’s Seattle Division contacted the FBI legal attache in Rome, who 
provided an official request to the Italian national police for assistance. But on 


June 12^ perhaps fed up with the mocking, the FBI applied for and obtained a 



search warrant authorizing the bureau to send the CIPAV to the 
Timberlinebombinfo MySpace profile. Court documents reveal the search 
warrant was "executed" June 13 at 5:49 p.m. Though the CIPAV provided a 
wealth of information, Glazebrook's IP address would have been enough to 
guide the FBI to the teen's front door. John Sinclair, Glazebrook's attorney, says 
his client never intended to blow anything up — "it was a prank from the get- 
go" — but admits he hacked into computers in Italy to launder his activities, and 
that he launched the denial-of-service attack against the school district's 
network. 

Glazebrook was sentenced Monday to 90 days in custody, and given credit for 32 
days he's spent behind bars since his arrest. When he's released he'll be on two 
years' probation with internet and computer restrictions, and he's been expelled 
from high school. The teen is being held at the Thurston County Juvenile 
Detention Center, where he will serve out his sentence, says Sinclair. Sinclair 
says he was told that the FBI had tracked down his client in response to a 
request from local police — but that he didn't know exactly how the bureau did 
it. 

"The prosecutor made it clear that they wouldn't indicate how this device works 
or how they do it," says Sinclair. "For obvious reasons." Larry Carr, a 
spokesman with the FBI 's Seattle field office, couldn't confirm that the CIPAV is 
the same software previously known as Magic Lantern, but emphasized that the 
bureau's technological capabilities have grown since the 2001 report. The case 
shows that FBI scientists are equipped to handle internet threats, says Carr. "It 
sends a message that, if you're going to try and do stuff like this online, that we 
have the ability to track individuals' movements online and bring the case to 
resolution." 



Assistant General Counsel 
OGC, Privacy & Civil Libe rties Unit 

Phonej 

Fax j 


b2 

be 

b7C 


THE FOREGOING MAY BE A PRIVILEGED 

FBI OGC COMMUNICATION AND SHOULD NOT BE DISSEMINATED WITHOUT 

OGC APPROVAL 


SENSITIVE BUT UNCLASSIFIED 



SENSITIVE BUFUNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 
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(OTD) (CON) b7c 

From: 


IfOTD) (FBI) 


Sent: 
To: 

Co: 

Subject: 



' 1 V 1 T.VV « 1*1 

(OGC) (FBI) 



1 KOTD) (FBI): 

rET 


1 1 


(OGC) (FBI) 


bl 


SENSITIVE BUT 
NON-RECORD 



b6 

b7C 


1 the Donv we sent stated 



bl 

b2 

b7E 


b7E 


] 


Information Technology Specialist 
Operational Technology Division 

Office -T 
Mobile 
Pager -I 



b2 

be 

b7C 


— Original Message — 


From: 

Sent: 

To: 

Cc: 


[ 


1 






3oGC) (FBI) 

16 . 30 07 3:52 PM 


Subject: Re|_ 


ffltjl 


5 


) (FBI) 
(OTD) 

3 


m 


bOTD) ( FBI) 

J (OGC) (FBI) 


(OGC) (FBI); 


SENSITIVE BUT UNCLASSIFIED^ 
NON-RECORD 




bl 

b2 

b7E 

b6 

b7C 


assistant general Counsel 
Science and Technology Law Unit 


DATE: 10-20-2008 

CLASSIFIED BY 60322UC/LP/STP/gjg 
REAS OH: 1.4 (C) 

, DECLASSIFY OH: 10-20-2033 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED EXCEPT 

WHERE SHOWN OTHERWISE 
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Office of the General Counsel 
Fed eral Bureau of Inves tigation 

Ph-I I 

r.*u\ 1 

Ph (Secure) | 

Fax! I 


b2 


SENSrflVE BUT UNCtASSIFIED 


SENSIT IV&gUT UNCLASSIFIE D 
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From: 

Sent: 

To: 

Cc: 

Subject: 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 



— Original Message-— 

From: 

Sent: 

To: 

Cc: 

Subject: 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b2 

b6 

b7C 

b7E 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


1 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 10-20-2008 BY 60322UC/LP/3TP/gjg 





SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 

I 





From: 

Sent: 

To: 

Cc: 

Subject: 


1 (SE) (FBI) 

June 25. 200 711:53 AM 
, I fOGC) (FBI) 
KSE) (FBI); I 


Question 



:SE) (FBI); 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 



— Original 

From: 

Sent: 

To: 

Subject: 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 



SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


l 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 10-20-2008 BY 60322UC/LP/5TF/gi g 






IOTP) (CON) 

From: I 1 ( OGC\ (FBI) 

Sent: . Mnnrifltt. Jnnp ?fi ?flf)7 1,0:55 AM 

To: I | (SE) (FBI) 

Subject: 1 I Question 


SENSITIVE BUT UNCLASSIFIED 

NON-RECORD b6 

b7C 

b7E 


I I 

Assistant General Counsel 
Sr.jp nr pjmri TprhnolocL^ Law Unit 

Phone: |~ 

Sfir iirp nhnnfiT 

Fax ] 


SENSITIVE BUT UNCLASSIFIED 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-26-2008 BY 0322UC/LP/STP/gj g 


1 






SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


we won't overlap this week (I'm on leave on Friday), I wanted to get your thoughts on a question I received from SA 
Seattle. Here are the facts: 



SENSITIVE BUT UNCLASSIFIED 


ALL INFORMATION CONTAINED 

HEREIN 13 UNCLASSIFIED 

DATE 09-26-2008 BY 0322UC/LP/STP/gj g 


1 



r b6 1 
b7C 


(OTP) (CON) 


From: 

Sent: 

To: 

Subject: 


I ISE) (FBI) 

Tuesday. June 12. 2Q07 8:20 PM 
I _J(OGC) (FBI) 

RE: CIPAV Affidavit - Seattle Division 


UNCLASSIFIED 

NON-RECORD 


Thanks for your help. 


— Original Message- 


From: 

Sent: 

To: 

Cc: 


](OGC) (FBI) 


Tuesday, June 12, 2007 8:06 AM 

1 1(SE) 

I (SE) (F BI); 


I 


J(SE) 


Subject: RE: QPAV Affidavit - Seattle Divisio/ 


(FBli 

fOTDI rFBII 


SE)(OGA)| | 

RFET) 

Divisio 

1 

OGC) (FBI) 


J(SE) (FBI) 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


](SE) (FBI); 


Here are my comments on my legal review of the application for a search warrant in this case. This application is 
much better than the previous version, and there are only a few issues that I believe need to be addressed or clarified. 

Not a legal point, but check your formatting in para 1 1 . The way the document printed on my computer there were 
some problems. 


b2 

b7E 



. r> 

That's all that I have. I have spoken with l I and he has no technical issues that need addressing. Let me 

know how we can be of further help. 


Assistant General Counsel 
Scienc e and Technology L aw Unit 
Phone: l~ I 

Sec ure phonel I 

Fax:f ~ I 


b2 

b6 

b7C 


Origi nal Message — 

From: | |( SE) (FBI) 

Sent: Tuesday, June l£, 260/ 1:28 AlH 

To: 


Cc: 


l 


ZI(OGC) (Fell 
ISEI fFBnJ 


(SE) (FBI); 


Subject: CIPAV Affidavit - Seattle Division 


liOTD) (FBI) 
KSE) (OGA); 


(SE) (FBI) 


UNCLASSIFIED 

1 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-26-2003 BY Q322UC/LP/STP/gjg 


3 (SE) (FBI);[ 


](SE) (FBI); 



NON-RECORD 


]Attached is the revised affidavit. Copy was also sent to AUS/f 


f 


made the changes we discussed earlie r. [ 


i. 


o review 


li 


by the AUSA's secretary. Hoping to sign and deploy on Tuesday. Thanks, 




1 described the intended deployment strate gy, decribed the search warrant 

„ llhfi. formatting will be cleaned up 


« File: Revised Affidavit for 


t» 



(Fax) 

IfNextell DC : r 


b2 

b7E 

b6 

b7C 


UNCLASSIFIED 

\ 

UNCLASSIFIED 

UNCLASSIFIED 


i 


i 

i 
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KOTD) (CON) 


From; 

Sent: 

To: 

Subject: 


[ 


(OGC) (FBI) 
i uesday, June 12, 2d 07 9:25 AM 


|(OTD) (FBI) 


FW: CIPAV Affidavit - Seattle Division 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


l need you to review for technical issues. I'm reviewing for the legal aspects. 



Assistant General Counsel 
Scienc e and Technology Law Unit 
Phone i 

Secure phonal 
Fax:] 



1 


Original Messa ge 

From: 

Sent: 

Tot 
Cc: 




Tuesday, June 12, 200 / 1:28 AM 


k 


(SE) (FBI) 


Subject; 


PGC) ( FBI); 

EeLCFBI); 


[ 


J(SE) (FBI) 

CIPAV Affidavit - Seattle Division 




KOTD) (FBI) 
tt?) (OGA); 


JSE) (FBI) 


(SE) (FBI); 


UNCLASSIFIED 

NON-RECORD 

t 


b2 

b6 

b7C 


b6 

b7C 


1(SE) (FBI); 



f 


Attached is the revised affidavit Copy was also sent to AUSAI 

changes we discussed earlier,] 

register,! 


to review 


1 described the intended deplavmen t strategy, decribed the search warrant and conversion to pen 

\ The form atting will be cleaned up by the AUSA's secretary. 


J 


Hoping to sign and deploy on Tuesday. Thanks 


T 


l made the 

b2 
b7E 

be 
b7C 



Rev ised Af fidavit 

f °1 I- 


SAJ 


FBI Seattle 


pax) 

iNextel) DC: 


UNCLASSIFIED 


UNCLASSIFIED 


i 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-26-2008 BY Q32ZUC/LP/STP/gjg 








OTDi (CON 


From: 

Sent: 

To: 

Subject: 


I (OTD) (FBI) 

M ond ay, Jun e 11 . 2QQ7 3:38 pm 

If OGC) (FBI) 

FW: 288A-SE-93709 


UNCLASSfelED 

NON-RECORD 


FYI 


SSA l I 

Operational Technology Division 
Digital Evidence Section 
Cryptologic and Electronic Analysis Unit 
Software Development Group 

Idesk) 

cell) 

Tax-unclass) 


— Original Message — 

From: I I (OTD) (FBI) 

Sent: Friday, June 08, 2007 7 :04 PM 

TO! I I fSEI (FBI) 

Cc: I I OTP) (FBI) 

Subject: RE: 288A-SE-93709 

UNC^SlFIED 

NON-RECORD 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT' 
WHERE SHOWN OTHERWISE 


DATE: 09-26-2003 

CLASSIFIED BY 0322UC/LP/STP/gj g 

REASON: 1.4 (C) 

DECLASSIFY ON; 09-26-2033 













*4 


1 - . 




(OTD) (CON) 



From: 

Sent: 

To: 

MOTTA, THOMAS GREGORY (OTD) (FBI) 

, Friday. June 08. 2QQ7 9:17 AM 

kOGC) (FBI) 


b6 

Cc: 

1 

KOGC) (FBI);! 

IfOGC) fFBl) 1 . 

Logc) b7c 


3EHI 

1 (OGC) (YB\n 

IfOTDWFBhl 

— i — — i 


Subject: 



:osy (ran 


J(CyD) (FBI 


FW: uR5214/£}b/l HKbAI INVESTIGATION 


I. (OTD) 


UNCLASSIFIED 

NON-RECORD 


I believe that CIPAVs are now deployed by DITU. I forward this to ensure that this is brought to their attention and the 
attention of the relevant elements of OGC who are now counsel to that unit 


Thos. Gregory Motta 

Section Chief, Digital Evidence Section (DES) 

Operational Technology Division (OTD) 

Engineering Research Facility 

Bldg 27958A, Room A-207 

Qua ntico, VA 22135 

Tel. I 

Tel. 

Fax, 


— Original Mes sage — 

From: I l (PG) (FBI) 

Sent: . Friday, June.08. 2QQ7. 12:38 

To: 

Subject: 


% 


(CyD) (FBI); MOTTA, THOMAS GREGORY (OTD) (FBI) 
FW! UKb214/bt/ IHktAt llWfcSIlGATION 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


Being forwarded for your information is Urgent Report 5214 from FBI-Seattle regarding email bomb threats. 
SSA l 

Watch Supervi sor - SIOC 


— Original Mess 

a Qe 

he 

From: 

1 l(SE) (FBI) 

b7C 

Sent: 

Thursday, June 07, 2007 11:46 PM 

b2 

To: 

FBI_URGENT REPORTS 


Cc 

SE All Supervisors 



1 

ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-26-2008 BY 0322UC/LF/STP/gj g 






Subject: 


UNSUB TIMBERUNE HIGH SCHOOL * VICTIM, COMPUTER INTRUSION - THREAT; 288A-SE-93709 


UNCLASSIFIED 

NON-RECORD 


Please see the attached Urgent Report. If you have any questions, please feel free to contact me. 


Rl 


158brf02.ec (11 
KB) 


A/AS AC Seattle Division 
SSA • Squad 5 

Gang/Criminal Enterprise Program; 
Organized Crime Program; 

Viole nt Crimes Proorai 
Desk: 

NEXTEL: 


itq 


try; 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 

UNCLASSIFIED 



FD-1015 (8-26-2006) 


FBI URGENT REPORT 


Precedence IMMEDIATE 


Date: 06/07/2007 


To: Director 

SIOC 
Cyber 

Operational Technology 

CIRG 

Rome 

From: Seattle 

Contact : 


Approved By: 


b2 

b6 

b7C 


Drafted By: 


Subject/Title/Case ID #: UNSUB; 

TIMBERLINE HIGH SCHOOL - VICTIM, 
COMPUTER INTRUSION - THREAT; 
288A-SE-93709 

Purpose/Synopsis: OTHER MATTER WARRANTING THE IMMEDIATE 

ATTENTION OF FBI HQ EXECUTIVES 


INITIAL 
URGENT REPORT 


On 06/06/2007, the Seattle Field Office was contacted 
by the Lacey Police Department (LPD) , Lacey, WA, regarding e-mail 
bomb threats and Distributed Denial of Service ( DDOS) attacks 
received by Timberline High 'School, 6120 Mullen Road SE, Lacey, 
WA, 98503, in the North Thurston Public School District. 

The e-mail threats commenced on 06/04/2007, and 
continue to the present. To date, there have been three e-mail 
threats that resulted in three separate deployments of K-9 Units 
from the Washington State Patrol and severe disruption in routine 
school operations. There has also been an increase in local 
media coverage of the incidents and growing parental concerns. 

The e-mail content has repeatedly demeaned school 
faculty and teachers and taunts law enforcement. The UNSUB (S) 
also posted three of the e-mail threats in the "Comments" section 
of "The Olympian" news online website. 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-26-2006 BY 0322UC/LP/STP/gj g 






To; Director From; Seattle 
Re; 06/07/2007', 288A-SE-93709 


Investigation conducted by LPD identif 
Internet Protocol (IP) add resses being utilized, 

' L which at this time are believed to be 

proxies. A request for assistance has been forwarded to the 
~~~~ by LEGAT Rome . 


LPD conducted several interviews on persons of 
interest, however, no subject have been identified. Logical 
investigative leads are being pursued. 

FBI Seattle is developing a strategy to deploy a 
Computer and Internet Protocol Address Verifier (CIPAV) and 
drafting a search warrant affidavit. Seattle will also 
coordinate the investigation with LEGAT Rome and the Behavioral 
Analysis Unit. 

FBI involvement in the investigation will not be 
revealed at this time to facilitate a scenario through which the 
CIPAV could be successfully deployed. 

Graduation at Timberline High School is scheduled for 
06/15/2007, and the last day of instruction is 06/21/2007. 


♦♦C:\Documents and Settings\ 
Internet Files\158brf 02 . ec 



Local Settings\Temporary b6 




